bump
bump
bump
bump
Please don't do this. As you can see this is a fairly low-traffic forum, and your post was still in the first page. Doing this after just 1 day when your question is still clearly visible from the forum page with no additional info is not helpful.
I am having a lot of issues with adding something as simple as a default metric to my client config. What I am trying to do is ignore my providers pushed routes and use my own. The reason why I want to do this is I want make a spilt tunnel for certain sites that require me to have a American IP address.
The verison of linux I am using is Alpine Linux openvpn 2.3.x (similar to Gentoo)
You don't want metrics (and here's why.)
Metrics aren't used in modern Linux kernels, and while some routing daemons use them, this is less common in favor of multipath routes that use the 'weight' option instead. In short, unless you are using an advanced dynamic routing daemon with multipathing, you don't need metrics or weights. This would be BGP or OSPF or similar setups (not what you're using.)
If you don't want to accept the pushed routes, use the
--route-nopull OpenVPN directive. This stops your client from applying
all routes supplied from the server. Note that in net30 topology this could have implications if you don't add a route to the server's own IP or the VPN network (the latter required if you wish to talk to other hosts on the VPN network.)
From here you can add the routes you do want using the
vpn_gateway macro explained in the manpage under the --route option. For instance, if you wished to route packets bound for 203.0.113.0/24 across the VPN, you could use this in your client config:
--route 203.0.113.0 255.255.255.0 vpn_gateway
Finally, here's the last problem with what you want: websites aren't bound to static IPs. When you visit a website, your browser performs a DNS lookup (unless you're visiting an IP that doesn't use any DNS names in the objects it serves to you. This is rare.) The problem here is that DNS can change, have a low TTL, or be served on a round-robin backend where you don't even get all the possible IPs. Add to that techniques like geo-DNS (where the DNS reply depends on where in the world you query from) and this amounts to a problem.
The correct way to route just a single
application (like a web browser, but it could be any app really) across the VPN is to use an application-level proxy. SOCKS is a nice choice for browsers since it's supported nearly universally in clients, and can perform the DNS lookup on the SOCKS server. Note that this requires you to connect to a SOCKS proxy across the VPN, not simply route across it.
An alternative approach is to run a 2nd system (could be a VM) with --redirect-gateway, and connect though that since all external traffic would be routed across the VPN. Optionally, you could run a SOCKS server here and use your first system to connect to the VM.
